2006 WLC - Radius\Active Directory Authentication

Hi -

I am having an issue with a Cisco 2006 WLC. Here's the setup:

1 Cisco 2006 Wireless Lan Controller 4 Aironet 1131AG Access Points

There two WLAN's, a private lan (WLAN ID 1) and a Public lan (WLAN ID

I use a Windows 2003 Server running IAS as a RADIUS server.

WLAN 1 (Private) Set to WPA\\TKIP - using PEAP. The radius server checks Active Directory for membership to a group before granting access, so long as you have the right Certificate.

This works fine, all day long.

WLAN 2 (Public) Set to no security\\open. It is set to use Web Authentication. (You know, like browsing inside a starbucks etc. Automatically connect to the AP, but traffic is redirected to a Web Based log in before actually passing)

When I attempt to authenticate with the same user account that worked for the private wireless network (currently, they work on the same remote access policy on the radius server) I am repeatedly unsuccessful.

How ever, if I specify a Local Net User (Local to the WLC) Web Authentication works fine.

The bottom line here is:

I need Web Based Authentication to work against Active Directory.

I've followed the Configuration Example on Cisco.Com, but this environment varies slighty. In that example, ACS is used as the Radius server, whereas I want to Use a windows2003 server running IAS.

Any thoughts, comments, etc?

Much appreciated.